CVE-2026-21520: Microsoft Copilot Studio Indirect Prompt Injection ("ShareLeak")
CVE-2026-21520 is a high-severity prompt injection issue in Copilot Studio, an AI agent. Affected: Copilot Studio (pre-Jan 15 2026 patch).
Is Copilot Studio running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-21520- Severity
- high
- Attack type
- Prompt injection, Data exfiltration
- Component
- Copilot Studio · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2026-21520?
Copilot Studio concatenated SharePoint form input directly into the agent's system prompt with no sanitization, allowing an attacker filling a public comment field to inject a fake system-role message that overrode agent instructions and directed it to exfiltrate SharePoint customer data via Outlook. Discovered by Capsule Security; Microsoft patched January 15, 2026, though data had already been exfiltrated during the disclosure window.
Affected versions
| Affected | Fixed in |
|---|---|
Copilot Studio (pre-Jan 15 2026 patch) | No fixed version listed |
Am I affected by CVE-2026-21520?
You are affected if you run Copilot Studio (pre-Jan 15 2026 patch).
How do I fix CVE-2026-21520?
Apply Microsoft January 2026 security update. Audit SharePoint forms for injected content. Review Copilot Studio agent configurations for missing input sanitization.
How do I find every machine running Copilot Studio?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Copilot Studio and which version, then enforce a policy on it.